Introduction · Topic 1 of 3
Attacks, Security Mechanisms and Security Services
Learn the difference between attacks, security mechanisms and security services, and how MikroTik RouterOS features map to each service in a network.
- 4 min
- An attack is the action, a service is the goal and a mechanism is the tool.
- A passive attack observes. An active attack changes or disrupts.
- Passive attacks are prevented. Active attacks are detected and stopped.
What it is
Network security work starts with three ideas: the attack, the mechanism and the service.
An attack is any action that tries to compromise the information or the systems of an organisation. A security service is the goal you want to deliver, such as keeping data private. A security mechanism is the tool that provides the service, such as encryption or a firewall.
The MTCSE course uses these terms throughout. When you read a later chapter, ask yourself which attack it stops and which service it protects.
How it works
Attacks are grouped by what they do, and services and mechanisms are matched to them.
Passive and active attacks
A passive attack only observes. The attacker listens to traffic or collects information, but does not change anything. Sniffing a clear text login and scanning for open ports are good examples.
An active attack changes something or disrupts something. It may modify packets, replay old traffic, pretend to be another host or flood a service until it stops working.
Passive attacks are hard to detect because nothing changes on the network. The best defence is prevention, for example encryption. Active attacks are easier to notice, so detection and response matter more.
| Type | Goal | Example | Typical defence |
|---|---|---|---|
| Passive | Learn information | Sniffing, port scan | Encryption, hiding services |
| Active | Change or disrupt | Spoofing, flooding, brute force | Firewall, filtering, authentication |
Security services
A security service is a property that the network should have. The usual list is short.
- Confidentiality: only the right people can read the data.
- Integrity: the data was not altered on the way.
- Availability: the service works when users need it.
- Authentication: you know who or what is on the other end.
- Authorisation: a known user may do only what the policy allows.
- Accounting: actions are recorded so that they can be traced later.
- Non repudiation: a sender cannot deny having sent a message.
Security mechanisms
A mechanism is a concrete feature that delivers one or more services. A single mechanism often helps more than one service.
| Mechanism | Main service it supports |
|---|---|
| Encryption (IPsec, SSH, HTTPS) | Confidentiality |
| Hashing and digital signatures | Integrity, non repudiation |
| Passwords, keys and certificates | Authentication |
| Firewall filter rules | Authorisation, availability |
| User groups and permissions | Authorisation |
| Logging | Accounting |
| Rate limiting and connection limits | Availability |
Applying it on RouterOS
A RouterOS router offers mechanisms for most of these services. You will meet each one later in the course.
/ip firewall filter add chain=input connection-state=invalid action=drop
/user group print
/system logging add topics=firewall action=memory- The first command drops packets that do not belong to any valid connection. This protects availability.
- The second command lists the user groups that decide what each user may do. This is authorisation.
- The third command records firewall events so that they can be reviewed. This is accounting.
When an exam question names a goal such as "keep the data private", answer with the service first, then pick the mechanism that provides it.
What to remember for the exam
Seven facts are worth learning for this topic.
- An attack is the action, a service is the goal and a mechanism is the tool.
- A passive attack observes. An active attack changes or disrupts.
- Passive attacks are prevented. Active attacks are detected and stopped.
- Confidentiality, integrity and availability are the three core services.
- Authentication proves identity. Authorisation limits what that identity may do.
- Encryption mainly gives confidentiality. Hashing and signatures give integrity.
- Firewall rules and rate limits protect availability and access.
Common mistakes
Four confusions come up often.
Mixing up a service and a mechanism. Encryption is a mechanism. Confidentiality is the service that it provides.
Treating authentication and authorisation as the same thing. Authentication answers who you are. Authorisation answers what you may do.
Thinking a passive attack is harmless. Nothing changes on the network, but the attacker may still learn passwords or topology that make a later active attack easy.
Expecting one mechanism to cover every service. A firewall does not keep data private on the wire, and encryption does not stop a flood. A secure design combines several mechanisms.
A silent network is not proof of a safe network, because passive attacks leave no sign. Assume that clear text traffic can be read.
Check yourself
Work through these three questions.
What is the difference between a passive attack and an active attack?
A passive attack only observes traffic or gathers information. An active attack changes or disrupts something, for example by spoofing or flooding.
Which security service does encryption mainly provide?
Encryption mainly provides confidentiality. Hashing and signatures are the mechanisms for integrity.
How do authentication and authorisation differ?
Authentication proves who a user or device is. Authorisation limits what that known identity is allowed to do.
Topic 1 of 3 in Introduction
Test yourself on Introduction
The full MikroTik MTCSE question bank has 446 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.